CVE-2026-84288: NousResearch hermes-agent DOS Vulnerability

CVE-2026-84288 Overview

CVE-2026-84288 is a denial of service vulnerability in NousResearch hermes-agent versions up to 0.18.2. The flaw resides in the HermesACPAgent.prompt function within acp_adapter/session.py, part of the ACP Prompt Workflow component. Remote attackers with low privileges can manipulate prompt handling to trigger a denial of service condition against agent availability. The issue is categorized under CWE-404: Improper Resource Shutdown or Release. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. The vulnerability affects availability only, with no impact on confidentiality or integrity.

Critical Impact
Remote authenticated attackers can disrupt the availability of hermes-agent deployments by abusing queued prompt handling in the ACP session workflow.

Affected Products

NousResearch hermes-agent versions up to and including 0.18.2
Component: ACP Prompt Workflow (acp_adapter/session.py)
Function: HermesACPAgent.prompt

Discovery Timeline

2026-09-01 - CVE-2026-84288 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84288

Vulnerability Analysis

The vulnerability affects hermes-agent, an AI agent adapter that implements the Agent Communication Protocol (ACP). The defective code path is HermesACPAgent.prompt in acp_adapter/session.py. This function processes prompts submitted to an ACP session and manages queued workflow state.

An authenticated remote attacker can submit crafted prompts that cause resources associated with the session to not be released or reclaimed properly. Repeated abuse degrades the agent's ability to serve legitimate prompt requests. The exploit has been published publicly, increasing the likelihood of opportunistic use against exposed deployments.

Root Cause

The underlying weakness maps to CWE-404: Improper Resource Shutdown or Release. The HermesACPAgent.prompt function does not correctly release or bound resources tied to queued prompt handling in the ACP session lifecycle. Session or queue state persists in a way that consumes memory, connection slots, or worker capacity beyond what the agent can sustain.

Attack Vector

Exploitation requires network access to an exposed hermes-agent ACP endpoint and low-level authenticated privileges. No user interaction is required. The attacker submits prompts to the ACP session workflow to exhaust or hold agent resources, eventually preventing further legitimate requests from being serviced. Technical proof-of-concept details are published in the GitHub Report on Hermes DoS and referenced in VulDB CVE-2026-84288 Details.

No verified exploit code is republished here. Refer to the linked advisory for reproduction steps.

Detection Methods for CVE-2026-84288

Indicators of Compromise

Sustained growth in memory, worker thread, or open connection counts on hosts running hermes-agent without a corresponding increase in completed prompt responses.
Repeated ACP prompt requests from a single authenticated principal followed by hanging or timing out sessions in acp_adapter/session.py logs.
Application logs showing queued prompt entries that are never dequeued or completed.

Detection Strategies

Instrument hermes-agent to emit metrics for active ACP sessions, queued prompts, and prompt completion latency, then alert on anomalous ratios.
Correlate authenticated ACP client identity with request volume to identify a single principal driving a disproportionate share of prompt submissions.
Add process-level watchdogs that flag hermes-agent workers exceeding baseline resource thresholds.

Monitoring Recommendations

Track ACP endpoint availability with external synthetic probes to detect service degradation.
Ingest hermes-agent application and host telemetry into a centralized analytics pipeline for longitudinal baselining.
Alert on repeated client reconnection patterns that coincide with degraded prompt completion rates.

How to Mitigate CVE-2026-84288

Immediate Actions Required

Inventory all deployments of NousResearch hermes-agent and confirm versions running at or below 0.18.2.
Restrict network exposure of ACP endpoints to trusted clients only, using network ACLs or a reverse proxy with authentication controls.
Enforce per-client rate limits and concurrent session caps on prompt submissions to bound resource consumption.
Monitor the VulDB CVE-2026-84288 Details page for updates and any vendor response.

Patch Information

At the time of publication, the vendor did not respond to the disclosure and no official fixed release is referenced in the advisory. Operators should track the NousResearch hermes-agent disclosure and the upstream project for a patched version above 0.18.2.

Workarounds

Deploy hermes-agent behind a rate-limiting gateway that caps prompt submissions per authenticated identity and per session.
Configure aggressive session and queue timeouts so unfinished prompts are reaped rather than held indefinitely.
Run hermes-agent in isolated worker pools with memory and CPU cgroup limits to contain resource exhaustion blast radius.
Revoke or rotate credentials for any ACP client that exhibits abusive prompt behavior.

bash

# Example: enforce a per-client rate limit and connection cap in front of hermes-agent
# using an nginx reverse proxy (illustrative configuration)
limit_req_zone $http_authorization zone=acp_prompt:10m rate=5r/s;
limit_conn_zone $http_authorization zone=acp_conn:10m;

server {
    listen 443 ssl;
    server_name hermes.internal.example;

    location /acp/ {
        limit_req zone=acp_prompt burst=10 nodelay;
        limit_conn acp_conn 4;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
        proxy_pass http://hermes_agent_upstream;
    }
}